Filter by topic
All topics
Support & Management
Security
Cloud & Infrastructure
Compliance & Strategy
Business Technology
Free Security Assessment
Concepts
Support & Management
Hourly or Managed IT: Which one is right for your business?
For most businesses, the answer is managed. Hourly can still make sense if most of the work that earns you money doesn’t depend on technology, or if a managed plan is out of reach right now.
Free Security Assessment
How we put together your Free Security Assessment
The Free Security Assessment is a review of what’s already public about your business: your email setup, domain, website, phone listings and anything left open to the internet. We make one ordinary visit to your home page and never scan, log into or test anything.
Free Security Assessment
How to read your Free Security Assessment
Your Free Security Assessment starts with what’s working well, then lists each item worth confirming with how sure we are and how soon it’s worth handling. This page explains each part so you can read it on your own.
Business Technology
Can everyone use your website?
An accessible website is one people with disabilities can use, including people who use screen readers, a keyboard instead of a mouse, or zoom. Most common problems are small fixes your web developer can handle during routine updates.
Compliance & Strategy
Do ad and analytics trackers belong on your patient pages?
A tracking pixel is a small piece of code from an ad or analytics company that reports what visitors do on a website. On pages where patients book visits or log in, it can send health information to that company, so a practice should know which ones are there and why.
Security topics
Security
What is DMARC?
DMARC is a DNS record that tells other mail servers what to do with email that claims to come from your domain but can’t prove it.
Security
What is SPF, and why one record matters
SPF is a DNS record that lists the servers and services allowed to send email for your domain. Receiving mail servers check it to decide whether a message really came from someone you approved.
Security
DKIM, explained without the jargon
DKIM adds a digital signature to every email you send. Receiving servers check it against a key in your DNS to confirm the message came from your domain and wasn’t changed along the way.
Security
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
Security
How many admin accounts should your business have?
An admin account can change settings, reset passwords and read company data across Microsoft 365 or Google Workspace. Keep only a few, protect each one well, and use them only for admin work.
Security
Forwarding rules and connected apps: who else can read your email
Mail rules and connected apps can quietly send copies of your email somewhere else or read it in the background. Reviewing them, and limiting who can create them, closes access that a password change alone won’t.
Cloud & Infrastructure
Who holds the keys to your domain and website?
Your domain registrar, DNS provider and web host each have a login, and whoever holds those logins controls your website and where your email is delivered. Give each one its own strong password, turn on MFA, and know who has access.
Cloud & Infrastructure
Protecting your business phone number
Your business phone number can be moved to someone else’s phone or carrier if they can convince your carrier they’re you. A port-out PIN or number lock, a consistent number everywhere, and MFA on your phone-system portal close the easy paths.
Cloud & Infrastructure
Does your business own its domain name?
Your domain name is the address behind your website and email, and it is registered, not bought outright. Keep it registered to the business, renewed well ahead of time and locked against transfers.
Security
What is a lookalike domain, and how does it lead to fake invoices?
A lookalike domain is a web address registered to look like yours, such as one letter swapped or a different ending, and it can send email that passes normal checks. The best defense is a habit: confirm every payment change by phone, using a number you already trust.
Security
How do you keep a remote-access VPN safe?
A remote-access VPN lets staff reach the office network from anywhere, so it has to be reachable from the internet. That’s normal; what matters is keeping it updated, requiring MFA, and never putting remote desktop directly on the internet.
Security
Should your security cameras be reachable from the internet?
A security camera or video recorder whose login page can be reached from the internet invites anyone to try passwords and known flaws. Most businesses can keep phone viewing and close that open door.
Cloud & Infrastructure
Is your website’s software up to date?
Your website is built from software: the platform, its add-ons and the code libraries it loads. Keeping each piece current, removing what you don’t use and backing up first closes the known holes that automated attacks look for.
Security
What are MTA-STS, TLS-RPT and DNSSEC, and do you need them?
MTA-STS, TLS-RPT and DNSSEC are optional extras that make sure mail to your domain stays encrypted and your DNS answers can’t be forged. They’re worth doing after SPF, DKIM and DMARC are in place, not before.
Business Technology
Is your Google Business Profile telling customers the right thing?
Your Google Business Profile is the listing people see in Google Search and Maps, and many customers call straight from it. Keep its name, phone and hours matched to your website, and know exactly who can change it.